Re: [PATCH] dcache: error out if the name buffer is too short

[Oleg Nesterov <oleg@redhat.com>]

On 01/26, Oleg Nesterov wrote:
>
> Al, Denys, unless I am totally confused the "restart" logic is very broken.
> We can't simply restart because the main loop changes dentry?

Plus prepend_name() can't actually return -ENAMETOOLONG,
"int error" inside the loop is wrong.

I believe the minimal fix is something like below. I'll try to test
this change (currently I can't) later and resend. And I still think
it can be cleanuped a bit, but this is minor.

Oleg.


--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -3103,7 +3103,7 @@ char *simple_dname(struct dentry *dentry, char *buffer, int buflen)
 	/* these dentries are never renamed, so d_lock is not needed */
 	if (prepend(&end, &buflen, " (deleted)", 11) ||
 	    prepend(&end, &buflen, dentry->d_name.name, dentry->d_name.len) ||
-	    prepend(&end, &buflen, "/", 1))  
+	    prepend(&end, &buflen, "/", 1))
 		end = ERR_PTR(-ENAMETOOLONG);
 	return end;
 }
@@ -3113,32 +3113,34 @@ char *simple_dname(struct dentry *dentry, char *buffer, int buflen)
  */
 static char *__dentry_path(struct dentry *dentry, char *buf, int buflen)
 {
+	struct dentry *de;
 	char *end, *retval;
 	int len, seq = 0;
 	int error = 0;
 
+	if (buflen < 2)
+		goto Elong;
+
 	rcu_read_lock();
 restart:
 	end = buf + buflen;
 	len = buflen;
 	prepend(&end, &len, "\0", 1);
-	if (buflen < 1)
-		goto Elong;
 	/* Get '/' right */
 	retval = end-1;
 	*retval = '/';
+	de = dentry;
 	read_seqbegin_or_lock(&rename_lock, &seq);
-	while (!IS_ROOT(dentry)) {
-		struct dentry *parent = dentry->d_parent;
-		int error;
+	while (!IS_ROOT(de)) {
+		struct dentry *parent = de->d_parent;
 
 		prefetch(parent);
-		error = prepend_name(&end, &len, &dentry->d_name);
+		error = prepend_name(&end, &len, &de->d_name);
 		if (error)
 			break;
 
 		retval = end;
-		dentry = parent;
+		de = parent;
 	}
 	if (!(seq & 1))
 		rcu_read_unlock();